Handle properly "dots don't matter in gmail addresses" in KC with duplicate emails = false

74 views
Skip to first unread message

David D

unread,
Mar 30, 2023, 11:11:47 AM3/30/23
to Keycloak User
Hi,

Considering this realm settings and customer requirement to ignore dots in @gmail.com addresses just like Google does (2 accounts are the same if dots are inserted between characters before @) : 

2023-03-30_17-00.png

Basically username == email and disallow duplicates_ what is the best way to handle the "dots don't matter in gmail addresses" (or any other email provider) rule in Keycloak ?
 
Scenario example :

  • User registers with firstnam...@gmail.com in KC (let's say he/she forgets a dot between firstname and lastname). Everything will work, even verify email because email will be received in gmail.
  • User comes back later on another device and this time use Google social provider configured in Keycloak and select its already logged-in account firstname...@gmail.com (with a dot)
  • A second user account firstname...@gmail.com is created, which is "expected behaviour" from above configuration because KC will see 2 differents email addresses.
  • Technically in KC it is correct, but with Google, functionally it is not because gmail considers these addresses as aliases of the same account. It is causing some trouble later in customer information system. Customer would like the same behaviour as in Gmail and ignore dots
Of course, a custom SPI can be implemented in registration flow to handle specifically gmail aliases.
But First Broker login flow won't work and link existing account also has to consider this use-case with a custom review-profile step or another custom authentication step.

Do you see a better way to ignore dots in @gmail.com addresses in both  :

- classic register flow with form
- account creation from social provider idp

Thanks !
Reply all
Reply to author
Forward
0 new messages